Debian Bug report logs -
#621726
krb5-admin-server: kadmind dies after nmap -sV
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, ortegaga@gmail.com, Sam Hartman <hartmans@debian.org>:
Bug#621726; Package krb5-admin-server.
(Fri, 08 Apr 2011 09:29:10 GMT) (full text, mbox, link).
Acknowledgement sent
to Felipe Ortega <ortegaga@gmail.com>:
New Bug report received and forwarded. Copy sent to ortegaga@gmail.com, Sam Hartman <hartmans@debian.org>.
(Fri, 08 Apr 2011 09:29:20 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Package: krb5-admin-server
Version: 1.8.3+dfsg-4
Severity: important
After executing a command like this:
# nmap -n -sV krb01
where krb01 is the main kerberos server (krb5kdc and kadmind running), kadmind dies silently.
I suppose nmap sends some string when trying to guess the version of the program running, and
kadmind can't parse it.
Someone could use such a tool, or inject the malformed string directly, causing a DoS.
Attached is an strace output of the kadmind process while runing nmap against the server.
-- System Information:
Debian Release: 6.0.1
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages krb5-admin-server depends on:
ii debconf [debconf-2.0] 1.5.36.1 Debian configuration management sy
ii krb5-kdc 1.8.3+dfsg-4 MIT Kerberos key server (KDC)
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii libcomerr2 1.41.12-2 common error description library
ii libgssapi-krb5-2 1.8.3+dfsg-4 MIT Kerberos runtime libraries - k
ii libgssrpc4 1.8.3+dfsg-4 MIT Kerberos runtime libraries - G
ii libk5crypto3 1.8.3+dfsg-4 MIT Kerberos runtime libraries - C
ii libkadm5srv-mit7 1.8.3+dfsg-4 MIT Kerberos runtime libraries - K
ii libkdb5-4 1.8.3+dfsg-4 MIT Kerberos runtime libraries - K
ii libkeyutils1 1.4-1 Linux Key Management Utilities (li
ii libkrb5-3 1.8.3+dfsg-4 MIT Kerberos runtime libraries
ii libkrb5support0 1.8.3+dfsg-4 MIT Kerberos runtime libraries - S
ii libss2 1.41.12-2 command-line interface parsing lib
ii lsb-base 3.2-23.2squeeze1 Linux Standard Base 3.2 init scrip
krb5-admin-server recommends no packages.
krb5-admin-server suggests no packages.
-- debconf information:
krb5-admin-server/kadmind: true
* krb5-admin-server/newrealm:
[nmap_kadmind_strace.txt (text/plain, attachment)]
Information forwarded
to debian-bugs-dist@lists.debian.org:
Bug#621726; Package krb5-admin-server.
(Fri, 08 Apr 2011 13:17:13 GMT) (full text, mbox, link).
Acknowledgement sent
to Sam Hartman <hartmans@debian.org>:
Extra info received and forwarded to list.
(Fri, 08 Apr 2011 13:17:22 GMT) (full text, mbox, link).
Message #12 received at submit@bugs.debian.org (full text, mbox, reply):
tags 621726 confirmed security upstream
thanks
I guess it's good that I'm in the middle of a patch release for krb5
denial of service issues or something.
Thanks for the report and sorry about the embarrassment.
Reported upstream
Information forwarded
to debian-bugs-dist@lists.debian.org:
Bug#621726; Package krb5-admin-server.
(Fri, 08 Apr 2011 13:17:32 GMT) (full text, mbox, link).
Acknowledgement sent
to Sam Hartman <hartmans@debian.org>:
Extra info received and forwarded to list.
(Fri, 08 Apr 2011 13:17:38 GMT) (full text, mbox, link).
Added tag(s) upstream, confirmed, and security.
Request was from Sam Hartman <hartmans@debian.org>
to control@bugs.debian.org.
(Fri, 08 Apr 2011 13:22:06 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Sam Hartman <hartmans@debian.org>:
Bug#621726; Package krb5-admin-server.
(Wed, 13 Apr 2011 19:03:12 GMT) (full text, mbox, link).
Acknowledgement sent
to Tom Yu <tlyu@MIT.EDU>:
Extra info received and forwarded to list. Copy sent to Sam Hartman <hartmans@debian.org>.
(Wed, 13 Apr 2011 19:03:12 GMT) (full text, mbox, link).
Message #24 received at 621726@bugs.debian.org (full text, mbox, reply):
tags 621726 + fixed-upstream
thanks
Fix committed upstream and advisory published.
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt
Added tag(s) fixed-upstream.
Request was from Tom Yu <tlyu@MIT.EDU>
to control@bugs.debian.org.
(Wed, 13 Apr 2011 19:03:13 GMT) (full text, mbox, link).
Merged 621726 622681.
Request was from Tom Yu <tlyu@MIT.EDU>
to control@bugs.debian.org.
(Wed, 13 Apr 2011 19:39:17 GMT) (full text, mbox, link).
Added tag(s) pending.
Request was from Sam Hartman <hartmans@debian.org>
to control@bugs.debian.org.
(Thu, 02 Jun 2011 15:09:05 GMT) (full text, mbox, link).
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Tue, 12 Jul 2011 07:36:19 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Fri Aug 2 01:57:00 2024;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.